[aws_vpcflow_otel] Content pack of EDOT Cloud Forwarder for AWS - VPC Flow Logs

[mykola-elastic]

Content pack for EDOT Cloud Forwarder for AWS - VPC Flow Logs - Dashboard

Proposed commit message

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Screenshots

[mykola-elastic]

For Comparison

The dashboard from AWS package (AWS VPC Flow Logs), added the dashboard and changed some fields to match EDOT Cloud Forwarder for AWS field names

The Dashboard from this PR (using ES|QL)

I removed the map, I don't think I can draw anything on it using the data we have (I may be wrong)

[ishleenk17]

I removed the map, I don't think I can draw anything on it using the data we have (I may be wrong)

You are right. Till we have geo location fields populated. We can't use the map

[ishleenk17]

NOTE: Once this PR is included in the ECOT Collector, we should change the dashboard filter to
scope.attributes.awslogs_encoding.format: vpc_flow_log

[ishleenk17]

@mykola-elastic : In the dashboard we show details of only the reject logs and not Accept Logs. Any idea why ?

[ishleenk17]

@ShourieG : Could you please review this PR from Security POV ?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 336800f

History

• 💚 Build #31796 succeeded 2edc87e
• 💚 Build #31790 succeeded 9856ee1
• 💚 Build #31788 succeeded 0bd9130
• 💔 Build #31708 failed 5c427e8
• 💔 Build #31689 failed dbbec91

cc @mykola-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
95.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[mykola-elastic]

In the dashboard we show details of only the reject logs and not Accept Logs. Any idea why ?

@ishleenk17
I suppose it is to highlight either misconfiguration of blocking rules or when somebody tries to scan/attack but gets blocked.
That's more useful for spotting/troubleshooting.